AuroraMiddleware/v8
1
0
Fork 0
Code Issues 2 Pull Requests Releases Wiki Activity

[compiler] Update prototype chain lookup on MapRef and MapData

Browse Source 
Map::HasOnlyStablePrototypesWithFastElements and
Map::SerializeForElementStore were asking if the prototype was a
JSObject but they were doing so with the original map on every loop
iteration instead of the current prototype's map.

Also, we can change it so that instead of using the underlying data
to check if it was a JSObject, but we can get the same information
reading the map's instance_type directly.

Bug: v8:7790
Change-Id: I314b361e59dd16e101d4fbcfbe558aeffd576cd5
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2859164
Commit-Queue: Santiago Aboy Solanes <solanes@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74294}
This commit is contained in:
Santiago Aboy Solanes 2021-04-30 10:08:34 +01:00 committed by V8 LUCI CQ
parent b0ce0e3403
commit 885b1185b3
1 changed files with 6 additions and 10 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

16
src/compiler/heap-refs.cc
View File

@ -2946,15 +2946,11 @@ void MapData::SerializeForElementStore(JSHeapBroker* broker) {
// constructing MapRefs, but it involves non-trivial refactoring and this
// method should go away anyway once the compiler is fully concurrent.
MapRef map(broker, this);
for (MapRef prototype_map = map;;) {
prototype_map.SerializePrototype();
prototype_map = prototype_map.prototype().map();
if (prototype_map.oddball_type() == OddballType::kNull ||
!map.prototype().IsJSObject() || !prototype_map.is_stable() ||
!IsFastElementsKind(prototype_map.elements_kind())) {
return;
}
}
do {
map.SerializePrototype();
map = map.prototype().map();
} while (map.IsJSObjectMap() && map.is_stable() &&
IsFastElementsKind(map.elements_kind()));
}
bool MapRef::HasOnlyStablePrototypesWithFastElements(
@ -2962,7 +2958,7 @@ bool MapRef::HasOnlyStablePrototypesWithFastElements(
DCHECK_NOT_NULL(prototype_maps);
MapRef prototype_map = prototype().map();
while (prototype_map.oddball_type() != OddballType::kNull) {
if (!prototype().IsJSObject() || !prototype_map.is_stable() ||
if (!prototype_map.IsJSObjectMap() || !prototype_map.is_stable() ||
!IsFastElementsKind(prototype_map.elements_kind())) {
return false;
}